nestybox / nestybox/sysbox

--storage-opt size=1mb no longer honnored

Open
#697 8 comments 1 reaction 1 assignee View on GitHub

@ctalledo is already working on this.

Since May 10, 2023.

bug
Dominant language
Shell
Stars
3.9k
Forks
230
Avg merge
7h 48m
Merged PRs (30d)
3

Description

It is no longer possible to limit the root filesize limit of a container with --storage-opt (and an attacker can exhaust the host's inode or size limit - which can result in docker daemon exiting ungracefully).

expected behaviour

# docker run --rm  --storage-opt size=1mb  alpine dd bs=1M count=2 if=/dev/zero of=/dump.zero
dd: error writing '/dump.zero': No space left on device
1+0 records in
0+0 records out

=> Correct to fail after 1mb

experienced behaviour:

# docker run --rm --runtime=sysbox-runc  --storage-opt size=1mb  alpine dd bs=1M count=2 if=/dev/zero of=/dump.zero
2+0 records in
2+0 records out

=> This should have failed after 1mb

Checking the underlaying FS shows that prj-id is 0 ('no limit set'):

# docker run --rm --runtime=sysbox-runc --name foobar --storage-opt size=1mb -d alpine sleep 100
# lsattr -dp $(docker inspect foobar --format '{{.GraphDriver.Data.UpperDir }}')
    0 --------------e----- /sf/docker/overlay2/ed8815741a4e829f3ef3f730a8f521eb4cd7e9dc859b129ec377d48111d5d8d0/diff

=> The first '0' should be the XFS project ID. I believe 0 means that the storage-limit has not been set.

Running the same without sysbox-runc shows that docker correctly sets the limit:

# docker run --rm --name foobar --storage-opt size=1mb -d alpine sleep 100
lsattr -dp $(docker inspect foobar --format '{{.GraphDriver.Data.UpperDir }}')
   63 -------------------- /sf/docker/overlay2/7edf9eef2393201602370ed59e697bccd0962e0a7e2f4299f9079981916e50db/diff

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.